diff --git a/advisories/github-reviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json b/advisories/github-reviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json new file mode 100644 index 00000000000..096c1237dec --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8r2q-865v-wm8j", + "modified": "2025-04-02T17:12:06Z", + "published": "2025-04-01T00:30:34Z", + "aliases": [ + "CVE-2025-31687" + ], + "summary": "Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS). This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/spamspan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31687" + }, + { + "type": "PACKAGE", + "url": "https://git.drupalcode.org/project/spamspan" + }, + { + "type": "WEB", + "url": "https://git.drupalcode.org/project/spamspan/-/commit/90d622211c8bb316080a3af1dcf253b0d7e90791" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2025-016" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-02T17:12:06Z", + "nvd_published_at": "2025-03-31T22:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json b/advisories/github-reviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json new file mode 100644 index 00000000000..4655110f084 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ccc9-jgj7-hxc7", + "modified": "2025-04-02T17:13:11Z", + "published": "2025-04-01T00:30:34Z", + "aliases": [ + "CVE-2025-31690" + ], + "summary": "Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability", + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery. This issue affects Cache Utility: from 0.0.0 before 1.2.1.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/cache_utility" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31690" + }, + { + "type": "PACKAGE", + "url": "https://git.drupalcode.org/project/cache_utility" + }, + { + "type": "WEB", + "url": "https://git.drupalcode.org/project/cache_utility/-/commit/1abf7a438d56ccb11ee3cdac9bdd1707f369ab9e" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2025-019" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-02T17:13:11Z", + "nvd_published_at": "2025-03-31T22:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json b/advisories/github-reviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json new file mode 100644 index 00000000000..b4f01a48696 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv6r-mj9p-9xff", + "modified": "2025-04-02T17:12:52Z", + "published": "2025-04-01T00:30:34Z", + "aliases": [ + "CVE-2025-31689" + ], + "summary": "Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability", + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/gdpr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/gdpr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31689" + }, + { + "type": "PACKAGE", + "url": "https://git.drupalcode.org/project/gdpr" + }, + { + "type": "WEB", + "url": "https://git.drupalcode.org/project/gdpr/-/commit/d53f1cf1394c41c8885faaaaf576965161676e1f" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2025-018" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-02T17:12:52Z", + "nvd_published_at": "2025-03-31T22:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json b/advisories/github-reviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json new file mode 100644 index 00000000000..8c67d5c3578 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq45-cqhg-jwx5", + "modified": "2025-04-02T17:12:32Z", + "published": "2025-04-01T00:30:34Z", + "aliases": [ + "CVE-2025-31688" + ], + "summary": "Drupal Configuration Split Cross-Site Request Forgery (CSRF) vulnerability", + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery. This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/config_split" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.10.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/config_split" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31688" + }, + { + "type": "PACKAGE", + "url": "https://git.drupalcode.org/project/config_split" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2025-017" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-02T17:12:32Z", + "nvd_published_at": "2025-03-31T22:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json b/advisories/unreviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json deleted file mode 100644 index 4cd704c4438..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-8r2q-865v-wm8j/GHSA-8r2q-865v-wm8j.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8r2q-865v-wm8j", - "modified": "2025-04-01T00:30:34Z", - "published": "2025-04-01T00:30:34Z", - "aliases": [ - "CVE-2025-31687" - ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31687" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-contrib-2025-016" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-31T22:15:21Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json b/advisories/unreviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json deleted file mode 100644 index 0256eee5dbc..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-ccc9-jgj7-hxc7/GHSA-ccc9-jgj7-hxc7.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-ccc9-jgj7-hxc7", - "modified": "2025-04-01T00:30:34Z", - "published": "2025-04-01T00:30:34Z", - "aliases": [ - "CVE-2025-31690" - ], - "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31690" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-contrib-2025-019" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-31T22:15:21Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json b/advisories/unreviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json deleted file mode 100644 index aa25b70480b..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-jv6r-mj9p-9xff/GHSA-jv6r-mj9p-9xff.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jv6r-mj9p-9xff", - "modified": "2025-04-01T00:30:35Z", - "published": "2025-04-01T00:30:34Z", - "aliases": [ - "CVE-2025-31689" - ], - "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31689" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-contrib-2025-018" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-31T22:15:21Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json b/advisories/unreviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json deleted file mode 100644 index c9241876af2..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-qq45-cqhg-jwx5/GHSA-qq45-cqhg-jwx5.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qq45-cqhg-jwx5", - "modified": "2025-04-01T00:30:34Z", - "published": "2025-04-01T00:30:34Z", - "aliases": [ - "CVE-2025-31688" - ], - "details": "Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31688" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-contrib-2025-017" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-31T22:15:21Z" - } -} \ No newline at end of file